From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/arm/tools/Makefile | 57 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 arch/arm/tools/Makefile (limited to 'arch/arm/tools/Makefile') diff --git a/arch/arm/tools/Makefile b/arch/arm/tools/Makefile new file mode 100644 index 000000000..28b6da8ac --- /dev/null +++ b/arch/arm/tools/Makefile @@ -0,0 +1,57 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# linux/arch/arm/tools/Makefile +# +# Copyright (C) 2001 Russell King +# + +gen := arch/$(ARCH)/include/generated +kapi := $(gen)/asm +uapi := $(gen)/uapi/asm +syshdr := $(srctree)/scripts/syscallhdr.sh +sysnr := $(src)/syscallnr.sh +systbl := $(srctree)/scripts/syscalltbl.sh +syscall := $(src)/syscall.tbl + +gen-y := $(gen)/calls-oabi.S +gen-y += $(gen)/calls-eabi.S +kapi-hdrs-y := $(kapi)/unistd-nr.h +kapi-hdrs-y += $(kapi)/mach-types.h +uapi-hdrs-y += $(uapi)/unistd-oabi.h +uapi-hdrs-y += $(uapi)/unistd-eabi.h + +targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) + +PHONY += kapi uapi + +kapi: $(kapi-hdrs-y) $(gen-y) + +uapi: $(uapi-hdrs-y) + +# Create output directory if not already present +$(shell mkdir -p $(kapi) $(uapi)) + +quiet_cmd_gen_mach = GEN $@ + cmd_gen_mach = $(AWK) -f $(real-prereqs) > $@ + +$(kapi)/mach-types.h: $(src)/gen-mach-types $(src)/mach-types FORCE + $(call if_changed,gen_mach) + +quiet_cmd_syshdr = SYSHDR $@ + cmd_syshdr = $(CONFIG_SHELL) $(syshdr) --abis common,$* \ + --offset __NR_SYSCALL_BASE $< $@ + +quiet_cmd_systbl = SYSTBL $@ + cmd_systbl = $(CONFIG_SHELL) $(systbl) --abis common,$* $< $@ + +quiet_cmd_sysnr = SYSNR $@ + cmd_sysnr = $(CONFIG_SHELL) $(sysnr) $< $@ + +$(uapi)/unistd-%.h: $(syscall) $(syshdr) FORCE + $(call if_changed,syshdr) + +$(kapi)/unistd-nr.h: $(syscall) $(sysnr) FORCE + $(call if_changed,sysnr) + +$(gen)/calls-%.S: $(syscall) $(systbl) FORCE + $(call if_changed,systbl) -- cgit v1.3.1